@agent-link/agent
AgentLink local agent CLI
This report shows the evidence for @agent-link/agent@0.1.324. 41 of 60 known versions are blocked or flagged. The newest version, 0.1.343, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-10705 confirms this npm version as malicious.
Advisory
MAL-2026-10705
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @agent-link/agent (npm)
Details
The package's runtime connects to a hardcoded WebSocket relay (default wss://msclaude.ai) and dispatches messages received from that relay directly into a locally spawned PTY. terminal.js spawns the user's default shell (or powershell.exe on Windows) via node-pty and exposes a write() method that pipes network-received bytes straight into the shell (`ptyProcess?.write(data)`); connection.js routes `terminal_open` / `terminal_input` events from the WebSocket's `on('message')` handler to that PTY. This grants whoever controls the relay endpoint, or anyone holding a session URL, interactive command execution on the host running the agent, including via a `ping`/`GET`/`POST`/`http.request` command path in dist/local-control-client.js, dist/local-control-http.js, dist/tunnel.js, dist/upgrade-operations.js, and worker/worker.cjs. Publisher provenance for the relay is unclear: package.json homepage points at github.com/yilee/agentlink, the README's Related link points at a different GitHub owner (kailunshi_microsoft/AgenticWorker), and the branding plus hardcoded relay domain is msclaude.ai, which is not tied to a verifiable publisher identity. In addition, emergency-upgrade.js fetches a release manifest from https://msclaude.ai/files/agent/latest.json (and beta.json) and downloads a replacement tarball from the same origin, verifying only hash/size/name against a manifest served by that same origin — so control of msclaude.ai also grants signed-by-manifest package replacement.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
This is a real first-party agent lifecycle and persistence capability with install-time remote runtime execution, but it is guarded by prior adoption and limited to AgentLink-owned state. Source inspection found no concrete malicious chain or foreign/broad AI-agent control-surface mutation.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Global npm installation after the user has previously adopted the AgentLink version store.
Impact
A compromise of the allowed runtime publisher could execute a replacement AgentLink runtime in an already opted-in local agent installation.
Mechanism
Remote runtime download, staging, self-check execution, and AgentLink launcher update.
AI rationale
This is a real first-party agent lifecycle and persistence capability with install-time remote runtime execution, but it is guarded by prior adoption and limited to AgentLink-owned state. Source inspection found no concrete malicious chain or foreign/broad AI-agent control-surface mutation.
Evidence
package.jsonscripts/install-bridge.cjsdist/install-bridge.jsdist/runtime-release.jsdist/version-stager.jsdist/launcher-manager.jsdist/service.js~/.agentlink/versions~/.agentlink/launcher/launcher.cjs
Network endpoints2
msclaude.ai/files/agent/runtime/
Independent scan evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- package.json runs postinstall via scripts/install-bridge.cjs.
- Global install calls prepareInstalledVersionBridge when a prior version-store adoption exists.
- dist/runtime-release.js downloads a runtime manifest and .tgz from https://msclaude.ai.
- The manifest supplies both bundle URL and integrity; no embedded signing key or signature verification is present.
- dist/version-stager.js executes the downloaded bundle's CLI self-check before staging it.
- dist/launcher-manager.js installs a persistent launcher under the package-owned AgentLink home.
Evidence against
- The install bridge is skipped unless an existing adoption state, current version, and last-known-good version validate.
- Runtime URLs are restricted to msclaude.ai runtime paths (or loopback overrides).
- Bundles have size, SHA-1, SHA-512, archive-shape, and package identity checks.
- Service persistence is exposed through explicit agentlink-client service install/uninstall commands.
- No source evidence of credential harvesting, unrelated file collection, or writes to Claude/Codex/Copilot control files.
Behavioral surface
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-bridge.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/emergency-upgrade.jsView file
4import { join, posix } from 'path';
L5: import { gunzipSync } from 'zlib';
L6: export const RELEASE_MANIFEST_URLS = {
L7: latest: 'https://msclaude.ai/files/agent/latest.json',
L8: beta: 'https://msclaude.ai/files/agent/beta.json',
...
L179: }
L180: if (normalizedPath === 'package/package.json') {
L181: if (packageIdentity) {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/emergency-upgrade.jsView on unpkg · L4launcher/launcher.cjsView file
7
Findings
3 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable Persistencedist/service.js
HighPrevious Version Dangerous Deltaworker/worker.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelauncher/launcher.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/emergency-upgrade.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @agent-link/agent@0.1.324.
The versions list below shows the verdict for each recorded version.
- Avoid installing @agent-link/agent@0.1.324. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.